@spfn/auth 0.3.0-beta.6 → 0.3.0-beta.8

package/dist/client-proof.js

@@ -1078,6 +1078,60 @@ var AUTH_SURFACE_OPERATIONS = [
     responseType: "RevokeAllKeysResponse",
     summary: "Revokes every key the caller has, sparing the calling device unless asked otherwise.",
     since: "0.4.1"
+  },
+  {
+    id: "auth.device.start",
+    method: "POST",
+    path: "/_auth/device/start",
+    authProfile: "none",
+    requiresSession: false,
+    requestType: "StartDeviceAuthRequest",
+    responseType: "StartDeviceAuthResponse",
+    summary: "Parks a new device's public key and returns the codes it shows and polls with.",
+    since: "0.10.0"
+  },
+  {
+    id: "auth.device.poll",
+    method: "POST",
+    path: "/_auth/device/poll",
+    authProfile: "none",
+    requiresSession: false,
+    requestType: "PollDeviceAuthRequest",
+    responseType: "PollDeviceAuthResponse",
+    summary: "Asks whether the request has been answered; the approved answer is the login it produced.",
+    since: "0.10.0"
+  },
+  {
+    id: "auth.device.info",
+    method: "POST",
+    path: "/_auth/device/info",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "DeviceAuthInfoRequest",
+    responseType: "DeviceAuthInfoResponse",
+    summary: "Describes the device waiting on a user code, so the approver can recognise it before deciding.",
+    since: "0.10.0"
+  },
+  {
+    id: "auth.device.approve",
+    method: "POST",
+    path: "/_auth/device/approve",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "ApproveDeviceAuthRequest",
+    responseType: "DeviceAuthInfoResponse",
+    summary: "Lets the waiting device in, answering with the device it just let in.",
+    since: "0.10.0"
+  },
+  {
+    id: "auth.device.deny",
+    method: "POST",
+    path: "/_auth/device/deny",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "DenyDeviceAuthRequest",
+    summary: "Refuses the waiting device. Answers 204 with no body, so it names no response type.",
+    since: "0.10.0"
   }
 ];
 var ContractTypeError = class extends Error {
@@ -1325,6 +1379,7 @@ import {
 
 // src/server/types.ts
 var KEY_ALGORITHM = ["ES256", "RS256"];
+var KEY_PLATFORM = ["ios", "android", "web", "desktop"];
 
 // src/server/client-proof/wire-headers.ts
 var CLIENT_IDENTITY_HEADERS = {
@@ -1342,9 +1397,9 @@ function isAppKind(kind) {
 }
 
 // src/server/client-proof/contract-bundle.ts
-var CONTRACT_VERSION = "0.9.0";
+var CONTRACT_VERSION = "0.10.0";
 var CONTRACT_MAJOR = 0;
-var CONTRACT_SUPPORTED_RANGE = ">=0.9.0 <0.10.0";
+var CONTRACT_SUPPORTED_RANGE = ">=0.10.0 <0.11.0";
 function required(name, type) {
   return { name, type, optional: false };
 }
@@ -1515,7 +1570,7 @@ var CONTRACT_TYPES = [
     fields: [
       required("keyId", "string"),
       optional("deviceName", "string"),
-      optional("platform", "string"),
+      optional("platform", "KeyPlatform"),
       required("algorithm", "KeyAlgorithm"),
       required("fingerprintPrefix", "string"),
       required("createdAtMillis", "integer"),
@@ -1557,10 +1612,94 @@ var CONTRACT_TYPES = [
       required("revokedCount", "integer"),
       required("currentKeyRevoked", "boolean")
     ]
+  },
+  {
+    name: "StartDeviceAuthRequest",
+    fields: [
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      optional("algorithm", "KeyAlgorithm"),
+      optional("deviceName", "string"),
+      optional("platform", "KeyPlatform")
+    ]
+  },
+  {
+    name: "StartDeviceAuthResponse",
+    fields: [
+      required("deviceCode", "string"),
+      required("userCode", "string"),
+      required("expiresAtMillis", "integer"),
+      required("intervalMillis", "integer")
+    ]
+  },
+  {
+    name: "PollDeviceAuthRequest",
+    fields: [
+      required("deviceCode", "string")
+    ]
+  },
+  /**
+   * The poll union, flattened into the one shape this grammar can carry.
+   *
+   * `status` is the discriminant and the only required field; everything else
+   * belongs to one branch and is therefore optional. `intervalMillis` is the
+   * pending branch, and the five after it are the approved branch — the same
+   * fields `LoginResponse` carries, because an approved poll is the login the
+   * approval produced. `deviceAuthorization.pollStatusRule` states the pairing
+   * the grammar cannot.
+   */
+  {
+    name: "PollDeviceAuthResponse",
+    fields: [
+      required("status", "DeviceAuthPollStatus"),
+      optional("intervalMillis", "integer"),
+      optional("userId", "string"),
+      optional("publicId", "string"),
+      optional("email", "string"),
+      optional("phone", "string"),
+      optional("passwordChangeRequired", "boolean")
+    ]
+  },
+  /**
+   * Info, approve and deny each declare their own request type although all
+   * three carry nothing but `userCode`. An operation's request shape is its
+   * own: a field added to one of them later must not appear on the other two
+   * by accident, which is what a shared type would do.
+   */
+  {
+    name: "DeviceAuthInfoRequest",
+    fields: [
+      required("userCode", "string")
+    ]
+  },
+  {
+    name: "DeviceAuthInfoResponse",
+    fields: [
+      optional("deviceName", "string"),
+      optional("platform", "KeyPlatform"),
+      required("fingerprintPrefix", "string"),
+      required("requestedAtMillis", "integer"),
+      required("expiresAtMillis", "integer")
+    ]
+  },
+  {
+    name: "ApproveDeviceAuthRequest",
+    fields: [
+      required("userCode", "string")
+    ]
+  },
+  {
+    name: "DenyDeviceAuthRequest",
+    fields: [
+      required("userCode", "string")
+    ]
   }
 ];
 var CONTRACT_ENUMS = [
-  { name: "KeyAlgorithm", values: [...KEY_ALGORITHM] }
+  { name: "KeyAlgorithm", values: [...KEY_ALGORITHM] },
+  { name: "KeyPlatform", values: [...KEY_PLATFORM] },
+  { name: "DeviceAuthPollStatus", values: ["pending", "approved"] }
 ];
 var BUNDLE_FILENAME = "spfn-mobile-contract.json";
 var BUNDLE_REPO_PATH = `contracts/mobile/${BUNDLE_FILENAME}`;